@namzu/cli 13.0.0 → 14.1.0

package/dist/integrations/providers/discover.js

@@ -1,12 +1,10 @@
 /**
  * Credential discoverer for LLM provider clients.
  *
- * For each entry in `PROVIDER_REGISTRY`, ask four questions in order:
- *   1. Is one of its env vars set in `process.env`?
- *   2. Is there a subscription credential in namzu's own store — the one the
- *      login flow writes? (every platform, and only `anthropic` consumes it.)
- *   3. Is there an OAuth credential in the login Keychain? (macOS only, and
- *      only `anthropic` consumes it.)
+ * For each entry in `PROVIDER_REGISTRY`, ask four questions:
+ *   1. Is there a usable session owned by an installed Claude or Codex harness?
+ *   2. Is there a subscription credential in namzu's own store?
+ *   3. Is one of its optional API-key env vars set in `process.env`?
  *   4. Is the probe URL (if any) reachable right now?
  *
  * The header used to say "three" and list two, and the one it omitted was the
@@ -19,14 +17,12 @@
  * hole.** `readAgentKeychainCredential` returns `null` on any other platform
  * before it looks at anything; it reads a credential belonging to a
  * co-installed tool, so it can only ever help someone who has that tool, on
- * that operating system. namzu's own store is asked first among the credential
- * sources and works everywhere, which is what makes signing in from inside
- * namzu useful on a machine that has neither.
+ * that operating system. namzu's own store works everywhere, which is what
+ * makes signing in from inside namzu useful on a machine that has neither.
  *
- * Order between the two matters when both answer. namzu's own store wins,
- * because it is the one namzu wrote and refreshes; preferring a borrowed
- * credential over the operator's own sign-in would make the login look
- * ineffective on precisely the machine where they bothered to run it.
+ * Order matters when both answer. A current device-harness session wins; a
+ * Namzu-owned sign-in is the fallback for a machine that has no usable harness
+ * session. API-key/env sources remain optional alternatives after both.
  *
  * The first positive answer per provider wins; subsequent sources are
  * recorded as "also available from" so the picker can show alternatives
@@ -61,9 +57,34 @@
  * picker can render immediately and refine if discovery completes later.
  */
 import { EnvCredentialProvider } from '@namzu/sdk';
-import { credentialsPath, readStoredSubscriptionCredential } from './credential-store.js';
+import { credentialsPath, readStoredCodexCredential, readStoredSubscriptionCredential, } from './credential-store.js';
+import { claudeCredentialsPath, codexCredentialsPath, preferFresherCredential, readClaudeFileCredential, readCodexFileCredential, } from './harness-credentials.js';
 import { KEYCHAIN_SERVICE, readAgentKeychainCredential } from './keychain.js';
 import { PROVIDER_REGISTRY } from './registry.js';
+/**
+ * Providers backed by a subscription session that is already usable now.
+ *
+ * This is intentionally narrower than "detected providers". An API key, a
+ * custom endpoint, and a local model are all valid optional choices, but none
+ * means the operator has already signed in to Claude or Codex. First-run
+ * routing uses this distinction to avoid asking for a second credential when
+ * the device already owns one.
+ *
+ * `CLAUDE_CODE_OAUTH_TOKEN` is included because it is the environment form of
+ * the same Claude device session. Generic Anthropic token/key variables are
+ * not: they are explicit API credentials and remain ordinary picker choices.
+ */
+export function signedInSubscriptionProviders(detected) {
+    return detected.filter((provider) => {
+        if (provider.entry.subscriptionLogin === undefined)
+            return false;
+        return [provider.source, ...provider.alternatives].some((source) => source.kind === 'claude-file' ||
+            source.kind === 'codex-file' ||
+            source.kind === 'keychain' ||
+            source.kind === 'stored' ||
+            (source.kind === 'env' && source.envName === 'CLAUDE_CODE_OAUTH_TOKEN'));
+    });
+}
 const DEFAULT_PROBE_TIMEOUT_MS = 500;
 export async function discoverProviders(opts = {}) {
     const env = opts.env ?? process.env;
@@ -103,14 +124,96 @@ export async function discoverProviders(opts = {}) {
     const storedCredential = opts.skipStored
         ? null
         : readStoredSubscriptionCredential(...(opts.home === undefined ? [] : [opts.home]));
+    const storedCodexCredential = opts.skipStored
+        ? null
+        : readStoredCodexCredential(...(opts.home === undefined ? [] : [opts.home]));
     // macOS-only: the OAuth credential a co-installed tool keeps in the login
     // Keychain.
     const keychainCredential = opts.skipKeychain ? null : readAgentKeychainCredential();
+    const claudeFileCredential = readClaudeFileCredential(opts.home);
+    const codexFileCredential = readCodexFileCredential(opts.home, env);
+    const usableCodexFileCredential = codexFileCredential?.expiresAt === undefined ||
+        codexFileCredential.expiresAt - Date.now() > 60_000
+        ? codexFileCredential
+        : null;
     for (const id of Object.keys(PROVIDER_REGISTRY)) {
         const entry = PROVIDER_REGISTRY[id];
         const sources = [];
         let apiKey;
         let oauth;
+        let codex;
+        if (id === 'anthropic') {
+            const borrowed = preferFresherCredential(claudeFileCredential, keychainCredential);
+            const usableBorrowed = borrowed?.expiresAt === undefined || borrowed.expiresAt - Date.now() > 60_000
+                ? borrowed
+                : null;
+            const borrowedSource = usableBorrowed === claudeFileCredential && usableBorrowed
+                ? {
+                    kind: 'claude-file',
+                    path: claudeCredentialsPath(opts.home),
+                }
+                : usableBorrowed
+                    ? { kind: 'keychain', service: KEYCHAIN_SERVICE }
+                    : undefined;
+            if (usableBorrowed && borrowedSource) {
+                if (apiKey === undefined) {
+                    apiKey = usableBorrowed.accessToken;
+                    oauth = {
+                        refreshToken: usableBorrowed.refreshToken,
+                        expiresAt: usableBorrowed.expiresAt,
+                        origin: borrowedSource.kind === 'claude-file' ? 'claude-file' : 'keychain',
+                    };
+                }
+                sources.push(borrowedSource);
+            }
+            const otherBorrowedSource = usableBorrowed && usableBorrowed === claudeFileCredential && keychainCredential
+                ? { kind: 'keychain', service: KEYCHAIN_SERVICE }
+                : usableBorrowed && usableBorrowed === keychainCredential && claudeFileCredential
+                    ? {
+                        kind: 'claude-file',
+                        path: claudeCredentialsPath(opts.home),
+                    }
+                    : undefined;
+            if (otherBorrowedSource)
+                sources.push(otherBorrowedSource);
+            if (storedCredential) {
+                if (apiKey === undefined) {
+                    apiKey = storedCredential.accessToken;
+                    oauth = {
+                        refreshToken: storedCredential.refreshToken,
+                        expiresAt: storedCredential.expiresAt,
+                        origin: 'stored',
+                    };
+                }
+                sources.push({
+                    kind: 'stored',
+                    path: credentialsPath(...(opts.home === undefined ? [] : [opts.home])),
+                });
+            }
+        }
+        if (id === 'codex' && (storedCodexCredential || usableCodexFileCredential)) {
+            const credential = usableCodexFileCredential ?? storedCodexCredential;
+            if (!credential)
+                throw new Error('unreachable');
+            apiKey = credential.accessToken;
+            sources.push({
+                kind: usableCodexFileCredential ? 'codex-file' : 'stored',
+                path: usableCodexFileCredential
+                    ? codexCredentialsPath(opts.home, env)
+                    : credentialsPath(...(opts.home === undefined ? [] : [opts.home])),
+            });
+            codex = {
+                accountId: credential.accountId,
+                expiresAt: credential.expiresAt,
+                origin: usableCodexFileCredential ? 'codex-file' : 'stored',
+            };
+            if (storedCodexCredential && usableCodexFileCredential) {
+                sources.push({
+                    kind: 'stored',
+                    path: credentialsPath(...(opts.home === undefined ? [] : [opts.home])),
+                });
+            }
+        }
         for (const envName of entry.envVars) {
             // Through the SDK's seam rather than a direct `env[envName]`. The
             // read is identical; what changes is that a host embedding the SDK
@@ -124,35 +227,6 @@ export async function discoverProviders(opts = {}) {
                 sources.push({ kind: 'env', envName });
             }
         }
-        if (id === 'anthropic' && storedCredential) {
-            if (apiKey === undefined)
-                apiKey = storedCredential.accessToken;
-            sources.push({
-                kind: 'stored',
-                path: credentialsPath(...(opts.home === undefined ? [] : [opts.home])),
-            });
-            // Only carry refresh metadata when this token is the one we'll
-            // actually use (an env/secrets token has no refresh path).
-            if (apiKey === storedCredential.accessToken) {
-                oauth = {
-                    refreshToken: storedCredential.refreshToken,
-                    expiresAt: storedCredential.expiresAt,
-                    origin: 'stored',
-                };
-            }
-        }
-        if (id === 'anthropic' && keychainCredential) {
-            if (apiKey === undefined)
-                apiKey = keychainCredential.accessToken;
-            sources.push({ kind: 'keychain', service: KEYCHAIN_SERVICE });
-            if (apiKey === keychainCredential.accessToken) {
-                oauth = {
-                    refreshToken: keychainCredential.refreshToken,
-                    expiresAt: keychainCredential.expiresAt,
-                    origin: 'keychain',
-                };
-            }
-        }
         if (sources.length === 0 && entry.probeUrl && !opts.skipProbes) {
             const reachable = await probe(entry.probeUrl, opts);
             if (reachable) {
@@ -166,6 +240,7 @@ export async function discoverProviders(opts = {}) {
                 apiKey,
                 baseUrl: entry.defaultBaseUrl,
                 ...(oauth ? { oauth } : {}),
+                ...(codex ? { codex } : {}),
                 alternatives: sources.slice(1),
             });
         }
@@ -177,7 +252,10 @@ async function probe(url, opts) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), opts.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS);
     try {
-        const res = await fetchFn(url, { method: 'GET', signal: controller.signal });
+        const res = await fetchFn(url, {
+            method: 'GET',
+            signal: controller.signal,
+        });
         return res.ok;
     }
     catch {

package/dist/integrations/providers/discover.js.map

@@ -1 +1 @@
-{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAA;AAE7E,OAAO,EAAE,iBAAiB,EAA+C,MAAM,eAAe,CAAA;AAkE9F,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACnC,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAuB,EAAE,CAAA;IAEvC,sEAAsE;IACtE,2CAA2C;IAC3C,EAAE;IACF,+DAA+D;IAC/D,EAAE;IACF,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,mCAAmC;IACnC,EAAE;IACF,gDAAgD;IAChD,EAAE;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,uEAAuE;IACvE,oDAAoD;IACpD,4EAA4E;IAC5E,uEAAuE;IACvE,sDAAsD;IACtD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,gCAAgC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpF,0EAA0E;IAC1E,YAAY;IACZ,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAA;IAEnF,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAA0B,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,OAAO,GAAsB,EAAE,CAAA;QACrC,IAAI,MAA0B,CAAA;QAC9B,IAAI,KAAgC,CAAA;QACpC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACrC,kEAAkE;YAClE,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACd,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAA;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACvC,CAAC;QACF,CAAC;QACD,IAAI,EAAE,KAAK,WAAW,IAAI,gBAAgB,EAAE,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAA;YAC/D,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aACtE,CAAC,CAAA;YACF,+DAA+D;YAC/D,2DAA2D;YAC3D,IAAI,MAAM,KAAK,gBAAgB,CAAC,WAAW,EAAE,CAAC;gBAC7C,KAAK,GAAG;oBACP,YAAY,EAAE,gBAAgB,CAAC,YAAY;oBAC3C,SAAS,EAAE,gBAAgB,CAAC,SAAS;oBACrC,MAAM,EAAE,QAAQ;iBAChB,CAAA;YACF,CAAC;QACF,CAAC;QACD,IAAI,EAAE,KAAK,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAA;YACjE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAA;YAC7D,IAAI,MAAM,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;gBAC/C,KAAK,GAAG;oBACP,YAAY,EAAE,kBAAkB,CAAC,YAAY;oBAC7C,SAAS,EAAE,kBAAkB,CAAC,SAAS;oBACvC,MAAM,EAAE,UAAU;iBAClB,CAAA;YACF,CAAC;QACF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YACnD,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;YACrD,CAAC;QACF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACb,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,CAAC,CAAoB;gBACrC,MAAM;gBACN,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;aAC9B,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,IAAqB;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CACvB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAC/C,CAAA;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5E,OAAO,GAAG,CAAC,EAAE,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACF,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAC3B,IAAiC,EACjC,EAAc;IAEd,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAA;AACnD,CAAC"}
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAElD,OAAO,EACN,eAAe,EACf,yBAAyB,EACzB,gCAAgC,GAChC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAA;AAE7E,OAAO,EAAE,iBAAiB,EAA+C,MAAM,eAAe,CAAA;AA4E9F;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAC5C,QAAqC;IAErC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QACnC,IAAI,QAAQ,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CACtD,CAAC,MAAM,EAAE,EAAE,CACV,MAAM,CAAC,IAAI,KAAK,aAAa;YAC7B,MAAM,CAAC,IAAI,KAAK,YAAY;YAC5B,MAAM,CAAC,IAAI,KAAK,UAAU;YAC1B,MAAM,CAAC,IAAI,KAAK,QAAQ;YACxB,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,yBAAyB,CAAC,CACxE,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACnC,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAuB,EAAE,CAAA;IAEvC,sEAAsE;IACtE,2CAA2C;IAC3C,EAAE;IACF,+DAA+D;IAC/D,EAAE;IACF,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,mCAAmC;IACnC,EAAE;IACF,gDAAgD;IAChD,EAAE;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,uEAAuE;IACvE,oDAAoD;IACpD,4EAA4E;IAC5E,uEAAuE;IACvE,sDAAsD;IACtD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,gCAAgC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpF,MAAM,qBAAqB,GAAG,IAAI,CAAC,UAAU;QAC5C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7E,0EAA0E;IAC1E,YAAY;IACZ,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAA;IACnF,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACnE,MAAM,yBAAyB,GAC9B,mBAAmB,EAAE,SAAS,KAAK,SAAS;QAC5C,mBAAmB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;QAClD,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,IAAI,CAAA;IAER,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAA0B,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,OAAO,GAAsB,EAAE,CAAA;QACrC,IAAI,MAA0B,CAAA;QAC9B,IAAI,KAAgC,CAAA;QACpC,IAAI,KAAgC,CAAA;QAEpC,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAA;YAClF,MAAM,cAAc,GACnB,QAAQ,EAAE,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;gBAC5E,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,CAAA;YACR,MAAM,cAAc,GACnB,cAAc,KAAK,oBAAoB,IAAI,cAAc;gBACxD,CAAC,CAAC;oBACA,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;iBACtC;gBACF,CAAC,CAAC,cAAc;oBACf,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBACjD,CAAC,CAAC,SAAS,CAAA;YACd,IAAI,cAAc,IAAI,cAAc,EAAE,CAAC;gBACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,GAAG,cAAc,CAAC,WAAW,CAAA;oBACnC,KAAK,GAAG;wBACP,YAAY,EAAE,cAAc,CAAC,YAAY;wBACzC,SAAS,EAAE,cAAc,CAAC,SAAS;wBACnC,MAAM,EAAE,cAAc,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU;qBAC1E,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;YAC7B,CAAC;YACD,MAAM,mBAAmB,GACxB,cAAc,IAAI,cAAc,KAAK,oBAAoB,IAAI,kBAAkB;gBAC9E,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE;gBACjD,CAAC,CAAC,cAAc,IAAI,cAAc,KAAK,kBAAkB,IAAI,oBAAoB;oBAChF,CAAC,CAAC;wBACA,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;qBACtC;oBACF,CAAC,CAAC,SAAS,CAAA;YACd,IAAI,mBAAmB;gBAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;YAC1D,IAAI,gBAAgB,EAAE,CAAC;gBACtB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAA;oBACrC,KAAK,GAAG;wBACP,YAAY,EAAE,gBAAgB,CAAC,YAAY;wBAC3C,SAAS,EAAE,gBAAgB,CAAC,SAAS;wBACrC,MAAM,EAAE,QAAQ;qBAChB,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;iBACtE,CAAC,CAAA;YACH,CAAC;QACF,CAAC;QAED,IAAI,EAAE,KAAK,OAAO,IAAI,CAAC,qBAAqB,IAAI,yBAAyB,CAAC,EAAE,CAAC;YAC5E,MAAM,UAAU,GAAG,yBAAyB,IAAI,qBAAqB,CAAA;YACrE,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;YAC/C,MAAM,GAAG,UAAU,CAAC,WAAW,CAAA;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;gBACzD,IAAI,EAAE,yBAAyB;oBAC9B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;oBACtC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aACnE,CAAC,CAAA;YACF,KAAK,GAAG;gBACP,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;aAC3D,CAAA;YACD,IAAI,qBAAqB,IAAI,yBAAyB,EAAE,CAAC;gBACxD,OAAO,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;iBACtE,CAAC,CAAA;YACH,CAAC;QACF,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACrC,kEAAkE;YAClE,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACd,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAA;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACvC,CAAC;QACF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YACnD,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;YACrD,CAAC;QACF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACb,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,CAAC,CAAoB;gBACrC,MAAM;gBACN,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;aAC9B,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,IAAqB;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CACvB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAC/C,CAAA;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,EAAE,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACF,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAC3B,IAAiC,EACjC,EAAc;IAEd,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAA;AACnD,CAAC"}

package/dist/integrations/providers/harness-credentials.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Read-only adapters for credentials owned by co-installed agent harnesses.
+ *
+ * These files are authorities, not migration inputs. Namzu reads the whole
+ * record, validates only the fields its provider wire needs, and never writes
+ * either file. In particular, refresh tokens remain owned by the harness that
+ * obtained them; consuming a single-use refresh grant here would race that
+ * owner and could log it out.
+ */
+import type { AgentOAuthCredential } from './keychain.js';
+export interface CodexOAuthCredential extends AgentOAuthCredential {
+    readonly accountId: string;
+}
+export declare function claudeCredentialsPath(home?: string): string;
+export declare function codexCredentialsPath(home?: string, env?: NodeJS.ProcessEnv): string;
+export declare function readClaudeFileCredential(home?: string): AgentOAuthCredential | null;
+/** Read a Claude-owned credential from the exact path discovery admitted. */
+export declare function readClaudeCredentialFile(path: string): AgentOAuthCredential | null;
+export declare function codexCredentialFromTokens(tokens: {
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly accountId?: string;
+}): CodexOAuthCredential | null;
+/**
+ * Read the ChatGPT subscription record produced by Codex CLI.
+ *
+ * `OPENAI_API_KEY` is intentionally ignored: it belongs to the ordinary
+ * OpenAI provider. This reader admits only the `tokens` envelope used by the
+ * Codex Responses backend and requires the account id that backend routes on.
+ */
+export declare function readCodexFileCredential(home?: string, env?: NodeJS.ProcessEnv): CodexOAuthCredential | null;
+/** Read a Codex-owned credential from the exact path discovery admitted. */
+export declare function readCodexCredentialFile(path: string): CodexOAuthCredential | null;
+/** Prefer the credential whose access token remains valid for longer. */
+export declare function preferFresherCredential<T extends AgentOAuthCredential>(left: T | null, right: T | null, now?: number): T | null;
+//# sourceMappingURL=harness-credentials.d.ts.map

package/dist/integrations/providers/harness-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-credentials.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/harness-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAIzD,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEtE;AAED,wBAAgB,oBAAoB,CACnC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAQR;AA6BD,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,MAAkB,GAAG,oBAAoB,GAAG,IAAI,CAE9F;AAED,6EAA6E;AAC7E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAWlF;AAOD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B,GAAG,oBAAoB,GAAG,IAAI,CAW9B;AAoBD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,oBAAoB,GAAG,IAAI,CAE7B;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAkBjF;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,oBAAoB,EACrE,IAAI,EAAE,CAAC,GAAG,IAAI,EACd,KAAK,EAAE,CAAC,GAAG,IAAI,EACf,GAAG,SAAa,GACd,CAAC,GAAG,IAAI,CASV"}

package/dist/integrations/providers/harness-credentials.js

@@ -0,0 +1,146 @@
+/**
+ * Read-only adapters for credentials owned by co-installed agent harnesses.
+ *
+ * These files are authorities, not migration inputs. Namzu reads the whole
+ * record, validates only the fields its provider wire needs, and never writes
+ * either file. In particular, refresh tokens remain owned by the harness that
+ * obtained them; consuming a single-use refresh grant here would race that
+ * owner and could log it out.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+const MAX_CREDENTIAL_FILE_BYTES = 1024 * 1024;
+export function claudeCredentialsPath(home = homedir()) {
+    return join(home, '.claude', '.credentials.json');
+}
+export function codexCredentialsPath(home = homedir(), env = process.env) {
+    const configured = env.CODEX_HOME?.trim();
+    const root = configured
+        ? isAbsolute(configured)
+            ? configured
+            : resolve(configured)
+        : join(home, '.codex');
+    return join(root, 'auth.json');
+}
+function readCredentialJson(path) {
+    try {
+        const stat = statSync(path);
+        if (!stat.isFile() || stat.size <= 0 || stat.size > MAX_CREDENTIAL_FILE_BYTES)
+            return null;
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function record(value) {
+    return typeof value === 'object' && value !== null ? value : null;
+}
+function optionalString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function optionalFiniteNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+function optionalStringArray(value) {
+    if (!Array.isArray(value) || value.some((item) => typeof item !== 'string'))
+        return undefined;
+    return value;
+}
+export function readClaudeFileCredential(home = homedir()) {
+    return readClaudeCredentialFile(claudeCredentialsPath(home));
+}
+/** Read a Claude-owned credential from the exact path discovery admitted. */
+export function readClaudeCredentialFile(path) {
+    const root = record(readCredentialJson(path));
+    const oauth = record(root?.claudeAiOauth);
+    const accessToken = optionalString(oauth?.accessToken);
+    if (!accessToken)
+        return null;
+    return {
+        accessToken,
+        refreshToken: optionalString(oauth?.refreshToken),
+        expiresAt: optionalFiniteNumber(oauth?.expiresAt),
+        scopes: optionalStringArray(oauth?.scopes),
+    };
+}
+export function codexCredentialFromTokens(tokens) {
+    if (tokens.accessToken.length === 0)
+        return null;
+    const claims = jwtClaims(tokens.accessToken);
+    const accountId = tokens.accountId ?? claims.accountId;
+    if (!accountId)
+        return null;
+    return {
+        accessToken: tokens.accessToken,
+        ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),
+        accountId,
+        ...(claims.expiresAt === undefined ? {} : { expiresAt: claims.expiresAt }),
+    };
+}
+function jwtClaims(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3 || !parts[1])
+        return {};
+    try {
+        const payload = record(JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8')));
+        const auth = record(payload?.['https://api.openai.com/auth']);
+        const exp = optionalFiniteNumber(payload?.exp);
+        return {
+            ...(exp === undefined ? {} : { expiresAt: exp * 1000 }),
+            ...(optionalString(auth?.chatgpt_account_id)
+                ? { accountId: optionalString(auth?.chatgpt_account_id) }
+                : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Read the ChatGPT subscription record produced by Codex CLI.
+ *
+ * `OPENAI_API_KEY` is intentionally ignored: it belongs to the ordinary
+ * OpenAI provider. This reader admits only the `tokens` envelope used by the
+ * Codex Responses backend and requires the account id that backend routes on.
+ */
+export function readCodexFileCredential(home = homedir(), env = process.env) {
+    return readCodexCredentialFile(codexCredentialsPath(home, env));
+}
+/** Read a Codex-owned credential from the exact path discovery admitted. */
+export function readCodexCredentialFile(path) {
+    const root = record(readCredentialJson(path));
+    const tokens = record(root?.tokens);
+    const accessToken = optionalString(tokens?.access_token);
+    if (!accessToken)
+        return null;
+    const accessClaims = jwtClaims(accessToken);
+    const idToken = optionalString(tokens?.id_token);
+    const idClaims = idToken ? jwtClaims(idToken) : {};
+    const accountId = optionalString(tokens?.account_id) ?? accessClaims.accountId ?? idClaims.accountId;
+    if (!accountId)
+        return null;
+    return codexCredentialFromTokens({
+        accessToken,
+        ...(optionalString(tokens?.refresh_token)
+            ? { refreshToken: optionalString(tokens?.refresh_token) }
+            : {}),
+        accountId,
+    });
+}
+/** Prefer the credential whose access token remains valid for longer. */
+export function preferFresherCredential(left, right, now = Date.now()) {
+    if (!left)
+        return right;
+    if (!right)
+        return left;
+    const leftExpiry = left.expiresAt ?? Number.POSITIVE_INFINITY;
+    const rightExpiry = right.expiresAt ?? Number.POSITIVE_INFINITY;
+    const leftFresh = leftExpiry > now + 60_000;
+    const rightFresh = rightExpiry > now + 60_000;
+    if (leftFresh !== rightFresh)
+        return leftFresh ? left : right;
+    return leftExpiry >= rightExpiry ? left : right;
+}
+//# sourceMappingURL=harness-credentials.js.map

package/dist/integrations/providers/harness-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-credentials.js","sourceRoot":"","sources":["../../../src/integrations/providers/harness-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAIrD,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAAA;AAM7C,MAAM,UAAU,qBAAqB,CAAC,OAAe,OAAO,EAAE;IAC7D,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACzC,MAAM,IAAI,GAAG,UAAU;QACtB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACvB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvB,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACvC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,yBAAyB;YAAE,OAAO,IAAI,CAAA;QAC1F,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/F,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7F,OAAO,KAAiB,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe,OAAO,EAAE;IAChE,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IACtD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,OAAO;QACN,WAAW;QACX,YAAY,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC;QACjD,SAAS,EAAE,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC;QACjD,MAAM,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;KAC1C,CAAA;AACF,CAAC;AAOD,MAAM,UAAU,yBAAyB,CAAC,MAIzC;IACA,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAA;IACtD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAC1E,CAAA;AACF,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC9C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC9C,OAAO;YACN,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;YACvD,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC;gBAC3C,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACtC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,IAAY;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACxD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,MAAM,SAAS,GACd,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,YAAY,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAA;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO,yBAAyB,CAAC;QAChC,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC;YACxC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACN,SAAS;KACT,CAAC,CAAA;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CACtC,IAAc,EACd,KAAe,EACf,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB,CAAA;IAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB,CAAA;IAC/D,MAAM,SAAS,GAAG,UAAU,GAAG,GAAG,GAAG,MAAM,CAAA;IAC3C,MAAM,UAAU,GAAG,WAAW,GAAG,GAAG,GAAG,MAAM,CAAA;IAC7C,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;IAC7D,OAAO,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;AAChD,CAAC"}

package/dist/integrations/providers/identity.d.ts

@@ -55,21 +55,14 @@ export declare const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
 export declare const SUBSCRIPTION_REDIRECT_PORT = 53692;
 export declare const REDIRECT_URI = "http://localhost:53692/callback";
 /**
- * Asked for at sign-in.
+ * The smallest source-verified scope set used by the current Claude harness.
  *
- * This is WIDER than namzu needs, and that is a knowing compromise rather
- * than an oversight. Least privilege would ask for an identity and the right
- * to run inference, and stop; this set also admits key creation and file
- * upload. It is the set the client identity above is exercised with by the
- * implementations that are known to work, and a narrower request cannot be
- * tested from here — nobody on this side of the flow holds a plan-backed
- * account to try it against. Guessing narrow fails in the worst place: the
- * sign-in succeeds, and inference is refused afterwards with an error about
- * scope that the operator cannot act on.
- *
- * So it is recorded as debt with the measurement that would settle it: sign
- * in with `user:profile user:inference` alone and send one message. If that
- * works, this shrinks to those two.
+ * Do not copy every scope a historical client happened to request. Unknown
+ * scopes make the authorization page reject the whole request before the
+ * operator can sign in, and key creation is not inference authority. These
+ * three are the live harness contract: identify the account, run inference,
+ * and retain the ability to create an API key from that harness when the
+ * account permits it.
  */
-export declare const OAUTH_SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+export declare const OAUTH_SCOPES = "org:create_api_key user:profile user:inference";
 //# sourceMappingURL=identity.d.ts.map

package/dist/integrations/providers/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,eAAO,MAAM,eAAe,yCAAyC,CAAA;AACrE,eAAO,MAAM,eAAe,iDAAiD,CAAA;AAC7E,eAAO,MAAM,aAAa,sCAAsC,CAAA;AAEhE,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,QAAQ,CAAA;AAC/C,eAAO,MAAM,YAAY,oCAA4D,CAAA;AAErF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,+GACoF,CAAA"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,eAAO,MAAM,eAAe,yCAAyC,CAAA;AACrE,eAAO,MAAM,eAAe,iDAAiD,CAAA;AAC7E,eAAO,MAAM,aAAa,sCAAsC,CAAA;AAEhE,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,QAAQ,CAAA;AAC/C,eAAO,MAAM,YAAY,oCAA4D,CAAA;AAErF;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,mDAAmD,CAAA"}

package/dist/integrations/providers/identity.js

@@ -55,21 +55,14 @@ export const AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';
 export const SUBSCRIPTION_REDIRECT_PORT = 53692;
 export const REDIRECT_URI = `http://localhost:${SUBSCRIPTION_REDIRECT_PORT}/callback`;
 /**
- * Asked for at sign-in.
+ * The smallest source-verified scope set used by the current Claude harness.
  *
- * This is WIDER than namzu needs, and that is a knowing compromise rather
- * than an oversight. Least privilege would ask for an identity and the right
- * to run inference, and stop; this set also admits key creation and file
- * upload. It is the set the client identity above is exercised with by the
- * implementations that are known to work, and a narrower request cannot be
- * tested from here — nobody on this side of the flow holds a plan-backed
- * account to try it against. Guessing narrow fails in the worst place: the
- * sign-in succeeds, and inference is refused afterwards with an error about
- * scope that the operator cannot act on.
- *
- * So it is recorded as debt with the measurement that would settle it: sign
- * in with `user:profile user:inference` alone and send one message. If that
- * works, this shrinks to those two.
+ * Do not copy every scope a historical client happened to request. Unknown
+ * scopes make the authorization page reject the whole request before the
+ * operator can sign in, and key creation is not inference authority. These
+ * three are the live harness contract: identify the account, run inference,
+ * and retain the ability to create an API key from that harness when the
+ * account permits it.
  */
-export const OAUTH_SCOPES = 'org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload';
+export const OAUTH_SCOPES = 'org:create_api_key user:profile user:inference';
 //# sourceMappingURL=identity.js.map

package/dist/integrations/providers/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAA;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,8CAA8C,CAAA;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,mCAAmC,CAAA;AAEhE,qEAAqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAA;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,0BAA0B,WAAW,CAAA;AAErF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,YAAY,GACxB,4GAA4G,CAAA"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAA;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,8CAA8C,CAAA;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,mCAAmC,CAAA;AAEhE,qEAAqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAA;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,0BAA0B,WAAW,CAAA;AAErF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,gDAAgD,CAAA"}

package/dist/integrations/providers/index.d.ts

@@ -1,11 +1,14 @@
-export { type DetectedProvider, type DetectionSource, type DiscoverOptions, discoverProviders, findDetected, } from './discover.js';
+export { type DetectedProvider, type DetectionSource, type DiscoverOptions, discoverProviders, findDetected, signedInSubscriptionProviders, } from './discover.js';
+export { type CodexOAuthCredential, claudeCredentialsPath, codexCredentialsPath, readClaudeCredentialFile, readClaudeFileCredential, readCodexCredentialFile, readCodexFileCredential, } from './harness-credentials.js';
 export { type AgentOAuthCredential, isAnthropicOAuthToken, readAgentKeychainCredential, } from './keychain.js';
-export { clearStoredSubscriptionCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, writeStoredSubscriptionCredential, } from './credential-store.js';
+export { beginCodexDeviceLogin, CODEX_AUTH_ORIGIN, CODEX_OAUTH_CLIENT_ID, type CodexDeviceLogin, type CodexDeviceLoginOptions, type CodexDeviceLoginOutcome, } from './codex-device-login.js';
+export { clearAllStoredCredentials, clearStoredSubscriptionCredential, clearStoredCodexCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, readStoredCodexCredential, replaceStoredCodexCredential, type StoredCodexCredential, writeStoredSubscriptionCredential, writeStoredCodexCredential, } from './credential-store.js';
+export { ensureFreshStoredCodexCredential, type StoredCodexRefreshOptions, } from './codex-oauth.js';
 export { OAUTH_SCOPES, REDIRECT_URI } from './identity.js';
 export { CredentialPublicationError, CredentialRefreshRejectedError, CredentialWithdrawnError, type CredentialOrigin, ensureFreshAnthropicToken, type OAuthMetadata, readSubscriptionCredential, refreshAgentOAuthToken, sameOAuthCredential, } from './oauth.js';
 export { beginSubscriptionLogin, type LoginOutcome, parsePastedInput, type SubscriptionLogin, type SubscriptionLoginOptions, subscriptionDetectedProvider, } from './subscription-login.js';
 export { type CapabilityDisagreement, chainCapabilityDisagreements, describeAcceptedMismatch, describeCapabilityRefusal, type MemberCapabilities, unresolvedMembers, } from './chain-capabilities.js';
 export { chainPositionName, type Preferences, PREFERENCES_FILE_VERSION, PreferencesError, preferencesPath, primaryProvider, type ProviderChoice, type ReadResult, readPreferences, writePreferences, } from './preferences.js';
-export { ALL_PROVIDER_IDS, missingCredentialMessage, PROVIDER_REGISTRY, type ProviderId, type ProviderRegistryEntry, type SdkProviderType, unsupportedProviderMessage, } from './registry.js';
+export { ALL_PROVIDER_IDS, missingCredentialMessage, PROVIDER_REGISTRY, type ProviderId, type ProviderRegistryEntry, type SubscriptionProviderId, type SdkProviderType, unsupportedProviderMessage, } from './registry.js';
 export { ensureRegistered, isRegistered, resolveChainCapabilities, } from './register.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/integrations/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,iBAAiB,EACjB,YAAY,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,iCAAiC,EACjC,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,iCAAiC,GACjC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,aAAa,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EACjB,KAAK,WAAW,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,iBAAiB,EACjB,YAAY,EACZ,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,EAChC,KAAK,yBAAyB,GAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,aAAa,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EACjB,KAAK,WAAW,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}

package/dist/integrations/providers/index.js

@@ -1,6 +1,9 @@
-export { discoverProviders, findDetected, } from './discover.js';
+export { discoverProviders, findDetected, signedInSubscriptionProviders, } from './discover.js';
+export { claudeCredentialsPath, codexCredentialsPath, readClaudeCredentialFile, readClaudeFileCredential, readCodexCredentialFile, readCodexFileCredential, } from './harness-credentials.js';
 export { isAnthropicOAuthToken, readAgentKeychainCredential, } from './keychain.js';
-export { clearStoredSubscriptionCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, writeStoredSubscriptionCredential, } from './credential-store.js';
+export { beginCodexDeviceLogin, CODEX_AUTH_ORIGIN, CODEX_OAUTH_CLIENT_ID, } from './codex-device-login.js';
+export { clearAllStoredCredentials, clearStoredSubscriptionCredential, clearStoredCodexCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, readStoredCodexCredential, replaceStoredCodexCredential, writeStoredSubscriptionCredential, writeStoredCodexCredential, } from './credential-store.js';
+export { ensureFreshStoredCodexCredential, } from './codex-oauth.js';
 export { OAUTH_SCOPES, REDIRECT_URI } from './identity.js';
 export { CredentialPublicationError, CredentialRefreshRejectedError, CredentialWithdrawnError, ensureFreshAnthropicToken, readSubscriptionCredential, refreshAgentOAuthToken, sameOAuthCredential, } from './oauth.js';
 export { beginSubscriptionLogin, parsePastedInput, subscriptionDetectedProvider, } from './subscription-login.js';

package/dist/integrations/providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,iBAAiB,EACjB,YAAY,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAEN,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,iCAAiC,EACjC,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,iCAAiC,GACjC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EAExB,yBAAyB,EAEzB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EAEtB,gBAAgB,EAGhB,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEN,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EAEjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EAIjB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,iBAAiB,EACjB,YAAY,EACZ,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAEN,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEN,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,GAIrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAE5B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,GAEhC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EAExB,yBAAyB,EAEzB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EAEtB,gBAAgB,EAGhB,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEN,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EAEjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EAKjB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}

package/dist/integrations/providers/oauth.d.ts

@@ -52,7 +52,7 @@ import { type AgentOAuthCredential } from './keychain.js';
  */
 export declare function readSubscriptionCredential(origin: CredentialOrigin): AgentOAuthCredential | null;
 /** Which store a subscription credential came from and therefore who owns publication. */
-export type CredentialOrigin = 'stored' | 'keychain';
+export type CredentialOrigin = 'stored' | 'keychain' | 'claude-file';
 export interface OAuthMetadata {
     readonly refreshToken?: string;
     readonly expiresAt?: number;
@@ -63,7 +63,7 @@ export interface OAuthMetadata {
 /** The credential that authorized a refresh was removed before publication. */
 export declare class CredentialWithdrawnError extends Error {
     readonly name = "CredentialWithdrawnError";
-    constructor();
+    constructor(message?: string);
 }
 /** The store could not prove whether the refresh still owned publication. */
 export declare class CredentialPublicationError extends Error {

package/dist/integrations/providers/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAWH,OAAO,EAAE,KAAK,oBAAoB,EAA+B,MAAM,eAAe,CAAA;AAsCtF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,IAAI,CAEhG;AAED,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,CAAA;AAEpD,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAClC;AAED,+EAA+E;AAC/E,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAkB,IAAI,8BAA6B;;CAKnD;AAED,6EAA6E;AAC7E,qBAAa,0BAA2B,SAAQ,KAAK;IACpD,SAAkB,IAAI,gCAA+B;gBAEzC,OAAO,CAAC,EAAE,YAAY;CAGlC;AAED,mFAAmF;AACnF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,SAAkB,IAAI,oCAAmC;IACzD,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAS;;CAKxC;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AA6DD,gGAAgG;AAChG,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,oBAAoB,GACzB,OAAO,CAcT;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA6DtC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAYH,OAAO,EAAE,KAAK,oBAAoB,EAA+B,MAAM,eAAe,CAAA;AAsCtF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,IAAI,CAGhG;AAED,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAA;AAEpE,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAClC;AAED,+EAA+E;AAC/E,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAkB,IAAI,8BAA6B;gBAEvC,OAAO,SAA0E;CAG7F;AAED,6EAA6E;AAC7E,qBAAa,0BAA2B,SAAQ,KAAK;IACpD,SAAkB,IAAI,gCAA+B;gBAEzC,OAAO,CAAC,EAAE,YAAY;CAGlC;AAED,mFAAmF;AACnF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,SAAkB,IAAI,oCAAmC;IACzD,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAS;;CAKxC;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AA8DD,gGAAgG;AAChG,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,oBAAoB,GACzB,OAAO,CAcT;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA6DtC"}